Data Processing Agreement

1. Parties and context

This Data Processing Agreement ("DPA") is entered into between SportAgenda ("Processor") and the club or organisation subscribing to the service ("Controller"). It supplements the Terms of Service and applies wherever SportAgenda processes personal data on behalf of the Controller under GDPR Article 28.

2. Subject matter and duration

SportAgenda processes personal data to provide club management services — including event scheduling, attendance tracking, member profiles, family relationships, and AI-assisted queries — for the duration of the active subscription.

3. Nature and purpose of processing

• Storing and managing member profiles, rosters, and family links.
• Processing event attendance and training statistics.
• Handling payment records via Stripe (as a separate processor).
• Powering the AI assistant with permission-scoped retrieval of club data.
• Sending transactional emails (invitations, confirmations, reminders).

4. Categories of personal data and data subjects

Data subjects: Club members, athletes, parents/guardians, coaches, and administrators.

Categories of personal data: Names, email addresses, date of birth, gender, nationality, addresses, training performance data, attendance records, payment history, and family relationship metadata.

5. Processor obligations (SportAgenda)

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (TLS, RBAC, encrypted backups).
• Not engage sub-processors without prior written consent; maintain a list of sub-processors.
• Assist the Controller in responding to data subject requests (access, rectification, erasure, portability).
• Delete or return all personal data upon termination of the service, at the Controller's choice.
• Provide all information necessary to demonstrate compliance with Article 28 GDPR.

6. Sub-processors

SportAgenda uses the following sub-processors:

7. Security measures

• Encryption in transit (TLS 1.2+) and at rest (encrypted database volumes and backups).
• Role-based access control (RBAC) at application and database level.
• HttpOnly, Secure, SameSite authentication cookies.
• AI assistant retrieval scoped to the requesting user's permission set at the SQL layer.
• Regular security patching and dependency updates.

8. Data subject rights assistance

Controllers may direct their members to use the in-app privacy settings to exercise their right to access (data export) and right to erasure (account deletion request). SportAgenda processes these requests within 30 days.

9. Breach notification

SportAgenda will notify the Controller without undue delay (and where feasible within 72 hours) upon becoming aware of a personal data breach affecting Controller data, as required by GDPR Article 33.

10. Contact

DPA enquiries: privacy@sportagenda.com